Adobe · ColdFusion
CVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
What it is
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
CISA: A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
- Added to the CISA list
- March 25, 2022
- Published
- August 11, 2010
- Severity
- High 7.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.7% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-22
- More details
- NVD · CVE.org · CISA
All references (5)
- http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
- http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07
- http://www.adobe.com/support/security/bulletins/apsb10-18.html
- http://securityreason.com/securityalert/8137
- http://securityreason.com/securityalert/8148
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 7, 2026 | Path Traversal | ColdFusion | Critical 10.0 | 42% |
| Feb 24, 2025 | Deserialization | ColdFusion | Critical 9.8 | 91% |
| Dec 16, 2024 | Improper Access Control | ColdFusion | High 7.4 | 99% |
| Jan 8, 2024 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | >99.9% |
| Jan 8, 2024 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | 97% |
| Aug 21, 2023 | Deserialization of Untrusted Data | ColdFusion | Critical 9.8 | 17% |
| Jul 20, 2023 | Improper Access Control | ColdFusion | High 7.5 | 99.8% |
| Jul 20, 2023 | Improper Access Control | ColdFusion | High 7.5 | 99.8% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.